Permissions belong outside the prompt

A request is not an access policy.

Anthropic’s May 2026 article on containment separates supervising an agent’s behaviour from limiting the resources it can reach. It describes controls around the execution environment and external content. It does not treat the model’s compliance as a complete security boundary.

For a company workflow, “only read this customer’s files” has to show up in what the runtime and tools can actually reach. The same goes for publishing a result or sending a payment request. Writing the rule down is necessary. Enforcing it is separate work.

Source [1]

Approve the business decision, not a wall of commands.

A good approval explains the proposed change in business terms, shows the relevant inputs and states the consequence. A finance approver should decide on an amount and a recipient, not work them out from a shell command. This is our design recommendation. It is not a claim that any interface removes the risk.

Put that decision before the action that has consequences. Keep together who approved, what they saw and which version ran. If the input changes after approval, the workflow needs an explicit rule on whether the approval still holds.

Check the state, not the success message.

Anthropic’s January 2026 evaluation guide separates an agent’s transcript from its actual outcome, and discusses using different graders to inspect behaviour and results. It is a reminder that a convincing final reply does not mean the task was done correctly.

For a workbook task, inspect the formulas, the changed cells and the saved file. For an order task, inspect the record in the receiving system. Test deliberate refusal as well as success: a useful agent sometimes has to stop because the input, the authority or the evidence is missing.

Source [2]

Local is a deployment choice. Control is an ongoing practice.

Hosting work on company infrastructure makes it easier to say where data sits and who runs what. It does not automatically secure every model endpoint, connector or credential. Write down the allowed destinations and actions, then check that the deployed setup matches.

A sensible rollout therefore tests permissions, recovery and review alongside the happy-path demo. The question is not whether to let agents work. It is whether the company can say where they may work, see what happened and recover when something goes wrong.